Coverage › CVE-2012-0767

CVE-2012-0767 Mapped Partial Sigma

Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability

Vendor / product

Adobe — Flash Player

Description (CISA)

Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.

Added to KEV

2022-06-08

Due date

2022-06-22

Required action

The impacted product is end-of-life and should be disconnected if still in use.

Known ransomware use

Unknown

CWE

CWE-79

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2012-0767

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

4 mapping objects across 4 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1098 Account Manipulation secondary impact

• DET0096 Account Manipulation Behavior Chain Detection
  AN0265 Windows

  Account attribute changes (e.g., password set, group membership, servicePrincipalName, logon hours) correlated with unusual process lineage or timing, indicating privilege escalation or persistence via valid accounts.

  WinEventLog:Security EventCode=4738, 4728, 4670 → DC0010 User Account Modification

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: TimeWindow HighPrivilegeGroupList SubjectTargetMismatch
  AN0266 Linux

  Use of native tools or scripting (e.g., usermod, passwd, groupmod) to escalate permissions or persist access on existing users, correlated with login or process events.

  auditd:SYSCALL usermod, groupmod, passwd → DC0010 User Account Modification

  auditd:PATH /etc/passwd or /etc/group file write → DC0061 File Modification

  Tunable: SudoPath ModifiedShellList
  AN0267 macOS

  Modifications to user accounts via dscl, pwpolicy, or System Preferences CLI (sysadminctl) that alter user groups, enable root, or bypass MDM restrictions.

  macos:unifiedlog com.apple.accountsd, com.apple.opendirectoryd → DC0010 User Account Modification

  Tunable: ModifiedUserList GroupMembershipChanges
  AN0268 Identity Provider

  Modifications to SSO/SAML user attributes (e.g., isAdmin, role, MFA bypass, App assignments) often through CLI, API, or rogue IdP apps.

  saas:okta User Attribute Modified / Role Assignment Changed → DC0010 User Account Modification

  Tunable: RoleAssignmentBaseline APIUsageContext
  AN0269 ESXi

  Addition of new users or changes to role permissions (e.g., ReadOnly -> Admin) via API or vSphere Client, particularly from non-jumpbox IPs.

  esxi:vpxa vim.SessionManager.login / vim.AccountManager.createUser → DC0066 Active Directory Object Modification

  Tunable: VMAdminAccountName NetworkAccessLocation
  AN0270 SaaS

  Role escalation (e.g., Editor → Owner) in cloud collaboration tools (Google Workspace, O365) or file sharing apps to maintain elevated access.

  m365:unified Admin Activity > Role Change or Sharing Change → DC0010 User Account Modification

  Tunable: SharingSensitivityLabel CrossOrgChanges

Sigma rules tagged attack.t1098 (34)

All 34 rules on the technique page →

T1114.002 Remote Email Collection secondary impact

• DET0048 Detect Remote Email Collection via Abnormal Login and Programmatic Access
  AN0131 Windows

  Detects adversaries accessing remote mail systems (e.g., Exchange Online, O365) using stolen credentials or OAuth tokens, followed by scripted access to mailbox contents via PowerShell, AADInternals, or unattended API queries. Detection focuses on abnormal logon sessions, user agents, IP locations, and scripted or tool-based email data access.

  azure:signinlogs Abnormal sign-in from scripting tools (PowerShell, AADInternals) → DC0067 Logon Session Creation

  m365:purview MailItemsAccessed & Exchange Audit → DC0038 Application Log Content

  WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: UserAgentPattern TimeWindow KnownIPLocations PrivilegedUserList
  AN0132 Office Suite

  Monitors programmatic access to user mailboxes in cloud-based email systems (e.g., O365, Exchange Online) using APIs or tokens. Focuses on OAuth misuse, suspicious MailItemsAccessed patterns, scripted keyword searches, and connections from untrusted agents or locations.

  m365:purview MailItemsAccessed, Search-Mailbox events → DC0038 Application Log Content

  azure:signinlogs Suspicious login to cloud mailbox system → DC0067 Logon Session Creation

  m365:unified Search-Mailbox, Get-MessageTrace, eDiscovery requests → DC0064 Command Execution

  Tunable: MailAccessVolumeThreshold OAuthClientIDAllowList KeywordSearchFrequency LoginGeolocationVariance

Sigma rules tagged attack.t1114.002 (0)

None. MITRE's strategy above is the only public detection guidance for this technique.

T1185 Browser Session Hijacking primary impact

• DET0507 Detect browser session hijacking via privilege, handle access, and remote thread into browsers
  AN1398 Windows

  Adversary gains high integrity or special privileges (e.g., SeDebugPrivilege), locates a running browser process, opens it with write/inject rights, and modifies it (e.g., CreateRemoteThread / DLL load) to inherit cookies/tokens or establish a browser pivot. Optional step: create a new logon session or use explicit credentials, then drive the victim browser to intranet resources.

  WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

  WinEventLog:Security EventCode=4673 → DC0013 User Account Metadata

  WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Sysmon EventCode=8 → DC0020 Process Modification

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: BrowserList AccessMaskSet SignerAllowList InternalCIDR TimeWindow ParentAllowList UserContext

Sigma rules tagged attack.t1185 (2)

T1204.001 Malicious Link exploitation technique

• DET0066 User Execution – Malicious Link (click → suspicious egress → download/write → follow-on activity)
  AN0178 Windows

  Behavioral chain: (1) a user-facing app (browser/Office/email client) launches a URL or handles a link, then (2) the same process lineage makes an outbound connection to an untrusted domain/IP, (3) a file is downloaded or unpacked to a user-writable location shortly after the click. Optional enrichment: subsequent child execution by LOLBINs.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  NSM:Flow Suspicious URL patterns, uncommon TLDs, short-lived domains, URL shorteners; HTTP method GET/POST → DC0085 Network Traffic Content

  Tunable: TimeWindow BrowserParents UserPaths SuspiciousTLDs AllowedCDNs
  AN0179 Linux

  Behavioral chain: (1) browser/office/GUI mail client opens a URL, (2) outbound connection to untrusted domain, (3) a new file is saved in $HOME/Downloads, /tmp, or cache immediately after.

  auditd:SYSCALL execve: Execs of chromium, google-chrome, firefox, libreoffice with http(s) in cmdline → DC0082 Network Connection Creation

  auditd:SYSCALL open,creat,rename: Writes in $HOME/Downloads, /tmp, ~/.cache with exe/script/archive/office extensions → DC0039 File Creation

  NSM:Flow Suspicious URL patterns, uncommon TLDs, URL shorteners → DC0085 Network Traffic Content

  Tunable: TimeWindow UserPaths HighRiskExtensions DomainRiskScore
  AN0180 macOS

  Behavioral chain: (1) Safari/Chrome/Firefox/Office handles a URL; unified logs show open/click or LSQuarantine assignment, (2) outbound connection to untrusted domain, (3) a new file appears in ~/Downloads or /private/var/folders/* with quarantine flag.

  macos:unifiedlog open URL|clicked link|LSQuarantineAttach → DC0085 Network Traffic Content

  NSM:Connections New outbound connection from Safari/Chrome/Firefox/Word → DC0082 Network Connection Creation

  fs:fsevents Create in /Users/*/Downloads or /private/var/folders/* with quarantine attribute → DC0039 File Creation

  Tunable: TimeWindow QuarantinePolicy SuspiciousTLDs

Sigma rules tagged attack.t1204.001 (4)